Privacy Policy and Statement

1. General

This statement sets out the privacy policy of the digital business card service available at https://bc-dev.nnd.co.il (the "Service"), where a business digital card can be built and published at a public link. The Service is operated by Tomer Ofer (Netdesign) (the "Operator"), who is also the owner of the Service's database.

The Operator may change or update the provisions of this statement from time to time; the date of the last update appears at the top of the page. We recommend reviewing it periodically. Terms not defined in this statement have the meaning given to them in the Terms of Use, as they may be from time to time, unless this conflicts with this statement.

This statement applies to any use, browsing or purchase of the Service's offerings, on the site or in any other way. Browsing the site and any other use of it constitute the consent of the user (the "User" or "you") to this statement, which is in addition to what is stated in the Terms of Use.

2. Information we collect

2.1 Account and login details

• On registration: name, email address and password. The password is stored encrypted (hashed), not as readable text.
• Temporary (guest) account: if you build a card without providing an email address (or the email address is already registered), a temporary account is created for you with an internal, non-real email address and an automatically generated password. The deletion policy for these accounts is set out in section 11.
• Login with Google: if you choose to log in with a Google account, we receive from Google your name, your email address, your Google account identifier and your profile picture (if any), in order to identify you.
• Login with Apple: if you choose to log in with Apple, we receive from Apple an account identifier, an email address (which may be a private Apple relay address, if you chose to hide your address) and a name, if you chose to share it, in order to identify you.
• Passkeys: only the public key of the passkey is stored with us. Fingerprint, face recognition or the device lock code are checked by the device itself and are not transferred to us.
• Two-factor authentication (optional): if you enable two-factor authentication using an authenticator app, we store the setup data required to verify the codes and your recovery codes.

2.2 Card content

The information you enter when building and editing the card: your name and business name, role and description, contact details (such as phone, email, address, website, WhatsApp number and social media accounts), the link buttons you chose, the texts in Hebrew and English, logo, cover image, the selected template, color scheme and design. Once the card is published, all the information that appears in it is visible to anyone who has the link, as set out in section 4.

2.3 Payments

Payment is made on the secure payment pages of the payment providers SUMIT and PayPal. Credit card details are entered with the provider only and are not stored by us. We store the transaction details: the plan, amount, currency, provider, the transaction identifier at the provider, the payment status and date, and the card to which the payment relates.

2.4 Technical information and usage information

While you use the Service, information about your use may be collected, such as: the pages you viewed, device type, operating system and browser, IP address, interface language, sources of arrival to the Service, and other statistical information (the "General Information" or "Non-Identifying Information"). In addition, we record on our servers usage events in the card creation and purchase process (such as card creation, opening the payment page and payment cancellation), and associate them with the card and the account. The session identifier is also used to limit use of the AI introduction chat in order to prevent abuse.

2.5 Views and actions on public cards

When a published card is viewed, views of the card are recorded (excluding views by the owner and by search engines and bots), and Google Analytics measures taps on the card's contact options, including the type of action (call, email, WhatsApp, save contact, social network, save to a digital wallet or another link) and the card identifier (its address). The link that was tapped and the button text are not sent. This information is used to produce statistics for the card owner and to improve the Service, and does not include the identity of the visitor. No cookie consent banner is shown on public card pages, and they run under the default of denial: analytics cookies are not set unless the visitor has already accepted them earlier on the site.

2.6 Inquiries to us

The content of inquiries you send us and the contact details you provide in them.

2.7 Marketing and conversion measurement data (subject to consent)

If you accepted analytics and advertising cookies in the consent banner, we store advertising attribution data: the parameters in the link through which you arrived at the Service (gclid, gbraid, wbraid and utm parameters), the landing page and the arrival time, and the Google Analytics client and session identifiers. This data is stored on the user record at registration, and at payment the Google Analytics identifiers and a flag indicating whether consent was given are stored with the payment record. Until you make your choice in the banner, a copy of the attribution parameters is kept in the browser only (sessionStorage), for the browsing session (until the tab is closed). After a purchase, and only if consent was given, a purchase event is sent from our server to Google for advertising measurement. Without consent, no advertising attribution data is stored and the purchase event is not sent.

Personal information you provided in registration, the profile, the card, or any information published or shared in the Service (the "Personal Information") may be stored in the Service's database. There is no legal obligation to provide information, but without providing the required information you may not be able to use some of the services. In the course of using the Service, personal information is not collected without your prior consent.

If the card includes details of another person (for example: a team member, partner or client), it is your responsibility to make sure you obtained their consent to publish the details, as set out in the Terms of Use.

3. Purposes of using the information

The information is collected by the Operator, itself and through third-party tools, in order to provide the Service to the user, and also to improve, operate and develop the Service, including analysis of viewing and usage habits, the scope and frequency of use and the sources of arrival to it, and measuring the effectiveness of advertising and referral activity for the Service. The information will be used only in accordance with this statement and any law. The uses of the information are as detailed below, but are not limited to them:

1. 3.1to enable use of the Service as set out in the Terms of Use: building a business card, editing it, publishing it at a public link and managing the account;
2. 3.2to process payments, to activate the card for the paid period and to manage its end;
3. 3.3to identify you at login and secure the account, including two-factor authentication, passkeys, password reset and preventing misuse and fraud;
4. 3.4to send you emails relating to the account and the Service, such as address verification, password reset and a reminder about a card that was built and not paid for (sent once per card, between one day and one week after it was created, and only to a real email address);
5. 3.5to send you marketing and promotional information, subject to your consent as required by law. At any time you may ask to stop receiving such information;
6. 3.6to handle inquiries and reports about cards, enforce the Terms of Use and remove prohibited content;
7. 3.7for analysis, collecting statistical information and advertising measurement;
8. 3.8to contact you where necessary;
9. 3.9for any other purpose set out in this statement or in the Terms of Use.

For collecting statistical information and monitoring the Service's activity, the Operator uses external providers (such as Google Analytics). The information collected for this purpose is statistical in nature and is not intended to identify you personally, and the service provider may retain it in its databases. However, the Operator does not undertake that the information will not identify a user in any case.

Additional information may be collected for future direct-mail contact, by any means of communication (email, messages and similar technologies, existing and future), and in any marketing activity carried out by the Operator – all subject to your consent and the provisions of the law.

4. A published card is public

Important to know: after payment, the card is published at a public address. Anyone who has the link to the card, including any person browsing the internet, can view the card and all its content, including names, roles, phone numbers, email addresses, addresses, links, logo and images, and can save them as a contact (vCard), copy them and use them. The Operator does not control further use of information published by third parties. Do not include in the card information that you do not want to be visible to the public.

• A card that has not been paid for is not published: whoever opens the link sees the card blurred, together with a notice that the card is not published. This preview does not include the card's contact details and links.
• A card whose paid period has ended stops being published, as set out in the Terms of Use.
• A card deleted from the account is no longer shown to the public.
• Search engines and other parties may keep copies of public pages even after they are removed, and the Operator has no control over this.

5. The AI introduction chat (optional)

When building the card you may, at your choice, use a chat with an artificial intelligence assistant that collects your business details and builds a draft card from them. Using the chat is optional, and you can also build the card without it, using a regular form.

• What is sent: the messages you type in the chat (including, depending on what you choose to write, your name, business name, role, email address, phone number, description, address and links), together with the assistant's system instructions, and with some providers also the details extracted so far from the chat. Images you upload (logo, cover image) are not sent to the AI provider.
• Where to: the chat is processed by one external AI provider, according to the Service's settings at any given time: Google (Gemini), Anthropic (Claude) or Cloudflare (Workers AI). The provider processes the information in accordance with its own privacy policy and terms, and may do so outside Israel. Do not provide in the chat information that you do not want transferred to these providers.
• What is stored: the details extracted from the chat are used to create the card and the account and are stored in them. The assistant's output may be wrong or partial, and you are responsible for checking and correcting the card before it is published.
• Usage limit: to prevent abuse, the number of attempts and messages in the chat is limited for each unregistered user, counted by session identifier.

6. Saving to a digital wallet

If the card owner enabled it, visitors to a published card can add it to a Google or Apple digital wallet. The content of the digital pass is the public information in the card (business name, headline, contact details, link to the card and logo). When saving to Google Wallet this content is transferred to Google, and the logo is loaded by Google from a public address; when saving to Apple Wallet a file is created for you and stored on your device. Use of the wallet is also subject to the terms and privacy policy of Google and Apple.

7. Service providers and transfer of information outside Israel

The Operator uses external service providers to operate the Service, and they receive information to the extent required to provide the service to us:

• Cloud servers for hosting the Service, the information and the images;
• Mailjet: sending operational emails, such as verification, password reset and reminders as set out in section 3.4;
• SUMIT and PayPal: payment processing on the provider's secure payment pages. SUMIT receives the customer name (the business name, or if none the user name) and email address, for real accounts; the placeholder email address of a guest account is not sent. With PayPal, the payer's details are entered with PayPal;
• Google: login with Google, measurement and analysis (Google Analytics), advertising measurement (Google Ads), digital wallet (Google Wallet), and processing of the introduction chat using Gemini if selected as the provider, as set out in section 5;
• Apple: login with Apple and digital wallet (Apple Wallet);
• Anthropic and Cloudflare: processing of the AI introduction chat if selected as the provider, as set out in section 5.

Some of these providers operate outside Israel, and therefore the information may be stored or processed outside Israel. We transfer to providers only the information required for the purpose for which they are used, and do so in accordance with applicable law. The providers are also subject to their own privacy policies and terms.

8. Transfer of general and statistical information

The Operator may transfer from time to time the general and statistical information of all users to third parties, for its business, operational, marketing and technical needs, including:

1. 8.1creating lists in order to build a database;
2. 8.2approaching with offers to purchase products or services, or to participate in services, promotions or initiatives of the Operator;
3. 8.3any other marketing and business activity of the Operator.

The Operator will not be limited in any way in transferring general, statistical and non-identifying information, all at its sole discretion.

9. Transfer of personal information

Beyond the service providers listed in section 7 and the public publication described in section 4, the Operator may transfer from time to time a user's personal information to third parties, in the cases detailed below, but not only:

1. 9.1at the user's request;
2. 9.2in order to comply with an instruction of an authorized body by law or a court order;
3. 9.3in any case of a dispute, claim, demand, lawsuit or any legal proceedings between the Operator and the user;
4. 9.4to any entity related to the Operator, or where responsibility for operating the Service is transferred or assigned to another entity;
5. 9.5upon receiving a court order instructing the Operator to provide information about you to a third party;
6. 9.6in any case in which the Operator considers that providing the information is necessary to prevent serious harm to your person or property, or to the person or property of a third party;
7. 9.7if the user uses the Service to commit an unlawful act or omission, or contrary to the Terms of Use, or to commit an act or omission that may harm the Service, its operators, or their property or interest, and also in any attempt to do the foregoing.

10. Cookies, local storage and advertising measurement

For its operation, including collecting information about use of the Service, authenticating the user's identity, keeping the login to the account, adapting the Service to the user's preferences and information security, the site uses cookies. Cookies are small text files stored in the browser. You can block or delete cookies in your browser settings, but some services, such as staying logged in, may not work properly. The site uses, among others, these cookies:

• Session and security cookies: necessary for the operation of the site, keeping the login to the account, securing forms and saving the language preference you selected.
• bc_consent: stores your choice in the cookie consent banner (180 days). By default, analytics and measurement cookies are not enabled until you approve. The banner is not shown on public card pages, which run under the default of denial.
• bc_attribution: set only after you accepted cookies (90 days); stores the source parameters in the link through which you arrived at the Service (gclid, gbraid, wbraid and utm) and the landing page, in order to attribute a purchase to the advertising campaign that brought it. Until you make your choice a copy is kept in the browser only (sessionStorage), as set out in section 2.7.
• Google Analytics and Google Ads cookies: for measuring use of the Service and measuring advertising performance.

The Operator uses Google Ads measurement to evaluate the effectiveness of its own online advertisements. No third-party advertisements are displayed in the Service. If you wish to prevent this kind of measurement, you can decline analytics and advertising cookies in the consent banner, block cookies in the browser, or act in accordance with the ad settings of your Google account.

11. Retention of information and automatic deletion

• Unpaid guest accounts: a temporary (guest) account on which no payment was made, and the cards in it, are automatically deleted 30 days after it was created. Deleting the cards is a logical (soft) deletion as set out below.
• Deleted cards: a card that was deleted (by the user, by the Operator or by the automatic deletion) is removed from public display, but is kept in the system in a way that allows the Operator to restore it, including its content, images and related payments, until it is permanently deleted.
• Expired cards: a card whose paid period has ended stops being published, but is kept in the account, and can be published again for a fee.
• Payment records: transaction records are kept as required for bookkeeping, tax and handling of claims, in accordance with law.

12. User consents, right of access, correction and deletion

Under the Protection of Privacy Law, 5741-1981, every person is entitled to review, himself or through his representative authorized in writing or his guardian, information about him held in a database. A person who reviewed information about himself and found that it is not correct, complete, clear or up to date may apply to the owner of the database with a request to correct or delete the information. Notice of refusal to allow review, or to correct or delete information, will be given to the requester in the manner and way set out in the regulations, and the requester may appeal it before the Magistrate's Court as set out in the regulations.

Most of your details are available for review and update when editing the card and in the account settings, and we invite you to correct yourself any detail that needs correction. In addition, you can exercise your right to review, correct or delete personal information about you by emailing [email protected]. We may ask to verify your identity before handling the request. Deleting personal information will not prevent use of non-personal information, as defined above.

If information in the database is used for personal direct-mail contact with you, you may demand in writing, under the Protection of Privacy Law, that the information relating to you be deleted from the database. If within 30 days you do not receive notice that the information was deleted, you will be entitled to apply to the Magistrate's Court in the manner set out in the regulations under the law, so that it instructs the Operator to act as stated. You may also remove yourself from mailings at any time using the unsubscribe link in the message or by contacting us.

Any information you provide in the Service, in registration or use, is provided of your free will and with your consent to the terms of this statement and the Terms of Use, and constitutes consent in accordance with sections 11 and 17 of the Protection of Privacy Law, 5741-1981, and subject to section 30A of the Communications Law (Telecommunications and Broadcasting), 5742-1982.

13. Deleting cards and the account

Deleting a card: you can delete a card at any time from the dashboard. The card is removed immediately from public display. The deletion is a logical deletion, as set out in section 11; to permanently delete the card and its content you may contact us by email.

Deleting the account: you can delete your account in the account settings (with password confirmation), or by contacting us by email. Deleting the account deletes your account and login details, including linked accounts, passkeys and the two-factor authentication settings. When the account is deleted, the owner's cards are also removed from public display. Payment records are not deleted and may be kept detached from the account; to have the cards and their content permanently deleted you may contact us by email. Permanent deletion of payment records is subject to the retention obligations that apply to us by law.

Deleting an account or a card will not prevent use of general, statistical and non-identifying information collected earlier.

14. Information security

The Operator takes reasonable measures to secure the information and reduce the risk of unauthorized access to it, including: encrypted communication (HTTPS), storing passwords in encrypted form, the option of two-factor authentication and passkeys, processing payments on the providers' payment pages without storing credit card details with us, and limiting access to information to authorized persons only.

However, these measures do not provide absolute security, and the Operator cannot ensure that information or messages will not be intercepted by third parties operating on the internet without authorization. Therefore the Operator does not undertake that the Service will be absolutely immune from unauthorized access to the information stored in it.

15. Age of users

As set out in the Terms of Use, use of the Service is permitted to legally competent users over the age of 18 or to corporations.

16. Changes to the Privacy Policy

The Operator may change or update the privacy policy from time to time, without prior notice. The changes will take effect upon their publication on this page. We will notify of material changes, as required, in the manner determined (for example a notice on the site). Continued use of the Service after the change constitutes consent to the privacy policy as amended.

17. Contact

For any question or request on privacy, including requests for review, correction and deletion, you may contact Tomer Ofer (Netdesign) by email at [email protected].